CVE-2026-2396 is a stored cross-site scripting vulnerability (CWE-79) in the kimipooh List View Google Calendar WordPress plugin. It arises from insufficient input sanitization and output escaping of the event description field, allowing authenticated administrators to inject arbitrary scripts. The vulnerability affects multi-site WordPress installations or installations where unfiltered_html is disabled, across all versions up to 7.4.3. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts into event descriptions, which execute in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by the victim user. The vulnerability does not affect availability. The impact is constrained by the requirement for administrator-level privileges and specific WordPress configurations (multi-site or unfiltered_html disabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling or replacing the vulnerable plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once available.